From: Oleksandr Kozaruk Date: Thu, 29 Aug 2013 07:55:48 +0000 (+0300) Subject: drivers: misc: ti-st: fix potential race if st_kim_start fails X-Git-Tag: v3.12-rc1~185^2~6 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=3a2d3d213d7c9bb427cc5bdb0de34fe18a22363e;p=profile%2Fivi%2Fkernel-x86-ivi.git drivers: misc: ti-st: fix potential race if st_kim_start fails If st_kim_start() fails registered protocols should be removed. This is done by calling st_reg_complete(), which as comment states is called with spin lock held. But in st_register() when st_kim_start fails it is called without holding spin lock, creating possibility of concurrent access to st_gdata data members. Hold spin lock while calling st_reg_complete if st_kim_start() fails. Signed-off-by: Oleksandr Kozaruk Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/misc/ti-st/st_core.c b/drivers/misc/ti-st/st_core.c index 0a14280..8d64b68 100644 --- a/drivers/misc/ti-st/st_core.c +++ b/drivers/misc/ti-st/st_core.c @@ -562,7 +562,9 @@ long st_register(struct st_proto_s *new_proto) if ((st_gdata->protos_registered != ST_EMPTY) && (test_bit(ST_REG_PENDING, &st_gdata->st_state))) { pr_err(" KIM failure complete callback "); + spin_lock_irqsave(&st_gdata->lock, flags); st_reg_complete(st_gdata, err); + spin_unlock_irqrestore(&st_gdata->lock, flags); clear_bit(ST_REG_PENDING, &st_gdata->st_state); } return -EINVAL;